ansible/requirements-python.txt

@@ -1,3 +1,3 @@
-ansible-core==2.21.2
+ansible-core==2.21.3
 proxmoxer==2.3.0
 requests==2.34.2

project-context.md

@@ -0,0 +1,25 @@
+# Haven project context
+
+## Purpose
+
+`haven` is the public GitOps specification repository for the Haven Kubernetes cluster. Argo CD continuously reconciles the manifests on `main` into the cluster.
+
+## Repository organization
+
+- `apps/<namespace>/*.yaml` — one application or infrastructure specification per file. The directory name selects its target namespace through the root ApplicationSet.
+- `apps/root/applicationset.yaml` — discovers `apps/*/*.yaml` and creates Argo CD Applications that automatically prune and self-heal.
+- `bootstrap/` — cluster bootstrap manifests such as namespaces, Argo CD configuration, and address pools.
+- `secrets/` — Kubernetes secret specifications referenced by applications.
+- `.gitea/workflows/trigger-renovate.yaml` — manually triggered Gitea Actions workflow that creates an immediate one-off Job from the live `cronjobs/renovate` CronJob.
+
+## Build and deploy
+
+- Commit manifest changes to `main`; the root ApplicationSet reconciles them automatically.
+- The `Trigger Renovate` Gitea workflow is manual-only (`workflow_dispatch`). It downloads `kubectl`, writes `${{ secrets.KUBE_CONFIG }}` to an ephemeral kubeconfig, verifies the live CronJob, then creates a uniquely named Job in the `cronjobs` namespace from `cronjob/renovate`.
+- The kubeconfig is supplied at execution time as the repository or organization `KUBE_CONFIG` secret. No credentials are stored in this repository.
+
+## Conventions
+
+- Keep Kubernetes manifest and workflow YAML LF-terminated; `.gitattributes` enforces this for `.yaml` and `.yml` files.
+- Do not commit plaintext credentials. Kubernetes resources should continue to reference the existing secret mechanisms.
+- A manual Renovate dispatch starts an additional run; the weekly CronJob schedule remains unchanged.